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Summary 

Fast-acting,  interactive  fault  monitoring  system 
used  to  protect  an  ERADCOM  resonantly  charged  50  kilo¬ 
joule,  6  megawatt  average  power  pulser  will  be  dis¬ 
cussed  as  to  its  design,  construction  and  history  of 
operating  performance. 

Introduction 

Multi-megawatt  average  power  repetitively  oper¬ 
ated  pulsers  using  multiple  switches  requires  fault 
protection  to  prevent  damage  to  the  pulser  or  its 
associated  load.  The  pulser  itself  has  to  be  pro¬ 
tected  against  unequal  current  sharing  through  the 
multiple  switches  and  against  load  or  internal  arcing. 
Furthermore,  when  a  fault  does  occur,  the  fault  pro¬ 
tection  must  signal  the  system  power  supply  to  cease 
operation. 

The  fault  logic  described  in  this  report  was 
designed  for  the  six  megawatt  average  power  pulser 
schematically  shown  in  Figure  1.  The  design  resulted 
from  an  earlier,  single  thyratron  fault  detector. 
Reference  1.  The  multi-megawatt  version  is  similar  to 
a  previously  reported  design.  Reference  2.  There  are 
six  MAPS-40  thyratrons,  Reference  3,  (EG&G  model  HY7) 
that  discharge  20  microsecond  (ps)  pulse  forming  net¬ 
works  (PFNs)  into  the  primary  of  a  step-up  pulse 
transfromer.  The  pulser  is  capable  of  delivering  50 
kilojoules  per  pulse  to  a  matched  load.  The  pulser 
was  resonantly  charged  from  a  direct  current  (dc) 
power  supply.  Each  of  the  six  modules  making  up  the 
pulser  consist  of  two  lumped  element  PFNs,  each  with 
its  own  end-of-line  clipper.  Reference  4.  The  two 
PFNs  operate  in  parallel,  discharging  through  one 
thyratron  per  module.  A  Hall  effect  current  sensor 
monitors  the  charging  current  feeding  the  pulser. 
Current  transformers  are  used  to  sense  tube  current, 
end-of-line  clipper  current  and  load  current.  An 
uncompensated  voltage  divider  is  used  to  monitor  the 
anode  charging  waveform.  In  addition  to  these  pulser 
sensors,  the  fault  monitor  generates  six  isolated 
trigger  signals  in  sync  with  a  system  command  signal. 
Each  of  the  six  trigger  signals  feeds  into  a  EG&G 
TM-30  thyratron  trigger  unit.  If  a  fault  is  detected, 
then  the  fault  monitor  generates  a  shut-down  signal  to 
prevent  damage  to  either  the  pulser  or  the  load. 

Logic  Design  Principles 

The  logic  guidelines  evolved  from  major  system 
considerations,  which  include  factors  such  as  the 
problem  of  protecting  expensive  pulser  and  system 
user  components  and  the  adverse  impact  of  system  down¬ 
time  on  scheduling  and  manpower.  In  order  to  protect 
key  components ,  the  logic  design  was  guided  by  the 
objective  of  detecting  all  faults  even  at  the  expense 
of  a  small  number  of  false  alarms.  To  maintain  a  high 
degree  of  reliability,  and  at  the  same  time,  a  low 
number  of  false  alarms  required  logic  with  the  highest 
degree  of  noise  immunity.  Any  damage  sustained  by 
the  fault  monitor  should  not  jeopardize  the  monitor's 
ability  to  generate  its  shut-down  sequence.  The  logic 
should  be  flexible  to  the  extent  that  it  could  be  made 
to  operate  with  any  number  of  pulser  modules.  It  was 
essential  that  the  logic  incorporate  a  self-check 
feature  to  assure  fault  monitor  operability.  To  mini¬ 
mize  down-time  the  fault  monitor  should  include  the 


identification  of  the  specific  fault  condition.  The 
fault  monitor  circuit  should  be  designed  so  that  those 
components  subject  to  failure  under  extreme  fault  con¬ 
ditions  could  be  easily  replaced  as  plug-in  units. 
Further,  the  damage  should  be  limited  to  only  those 
plug-in  units  and  not  propagate  beyond  them. 

Simplicity  was  a  key  guideline  in  the  fault  logic 
design.  The  types  of  faults  and  the  number  of  inputs 
were  chosen  on  the  basis  that  a  detected  fault  would 
result  in  system  damage  if  left  uncorrected.  The 
logic  display  was  designed  to  only  show  key  informa¬ 
tion.  A  logic  fault  simulator  was  constructed  as  a 
separate  unit  to  verify  the  operability  of  the  fault 
logic  rather  than  having  it  made  part  of  the  fault 
logic.  The  fault  logic  was  designed  to  "lock-up" 
on  the  first  fault  detected  and  to  ignore  the  conse¬ 
quent  faults.  The  "1st  fault"  performance  feature 
was  essential  to  the  fault  monitor  to  provide  diagnos¬ 
tic  capabilities  as  well  as  system  protection.  The 
fault  monitor  detects,  stores  and  displays  a  specific 
malfunction  when  it  occurs  greatly  enhancing  system 
maintenance  procedures  and  reducing  down-time.  Subse¬ 
quent  to  a  fault,  the  signals  from  all  sensors  can  no 
longer  be  relied  upon  to  provide  an  accurate  assess¬ 
ment  of  failure. 

CMOS  logic  was  selected  primarily  because  of  its 
superior  noise  immunity.  This  family  of  logic  can 
operate  at  comparatively  high  voltages,  up  to  20  volts 
and  because  of  its  complementary  structure,  CMOS  re¬ 
jects  noise  which  is  less  than  30  percent  of  the  sup¬ 
ply  voltage.  It  ignores  noise  common  to  both  the  in¬ 
put  and  power  supply  lines.  Built-in  diodes  protect 
the  CMOS  gates  shunting  larger  input  signals  to  the 
supply  line,  within  limits.  Another  important  aspect 
of  CMOS  logic  performance  is  the  low  current  required 
for  logic  operation.  This  feature  proves  to  be  ex¬ 
tremely  valuable  in  reducing  the  shielding  require¬ 
ments  for  the  logic  package.  Since  adequate  test 
data  was  not  available  on  CMOS  operation  in  very  high 
pulsed  field  environment,  an  experimental  battery 
operated  test  circuit  (a  timer)  was  constructed  using 
CMOS  logic.  The  circuit  was  packaged  in  a  commercial 
aluminum  small  chassis  box.  A  thin  aluminum  blank 
plate  covered  the  open  side  of  the  box  and  was  secured 
to  the  box  with  sheet  metal  screws.  No  additional 
shielding  was  used.  This  box  was  placed  in  a  pulsed 
0.3  Tesla  field  generated  at  the  open  end  of  the  sole¬ 
noid  of  a  high  energy  PFN.  The  timer  was  operated  in 
this  pulsed  field  for  three  hours  without  error.  The 
conclusion  was  that  CMOS  logic  is  relatively  insensi¬ 
tive  to  even  very  high  magnetic  fields.  This  verified 
our  original  supposition  that  only  electro-static 
shielding  was  required  for  the  fault  monitor. 

Flexibility  was  built  into  the  logic  design  by 
providing  adjustable  threshold  detection  limits  and 
adjustable  timing  signals  to  allow  for  varying  pulser 
repetition  rates.  The  fault  monitor,  as  built,  could 
operate  from  one  to  six  pulser  modules,  and  with 
additional  sensor  input  boards,  could  be  made  to  oper¬ 
ate  with  more  than  six  pulser  modules.  Additional 
flexibility  allows  the  operator  to  select  whether  to 
shut  down  the  system  if  one  switch  failed  to  fire,  or 
if  two  consecutive  failures  to  fire  were  detected. 

Minimal  stand-by  power  consumed  by  the  CMOS  logic 
allowed  the  fault  monitor  to  operate  from  internal 
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D  cell  batteries.  However,  the  bipolar  threshold  cir¬ 
cuits,  the  LED  display  unit  and  the  bipolar  Darlington 
driver  circuits  had  to  be  designed  to  conserve  power. 

To  protect  the  logic,  all  inputs  from  all  sensors 
were  provided  with  isolation  and  shaping  circuitry. 

The  system  command  trigger  was  transformer  isolated, 
as  was  the  output  triggers  to  the  six  thyratron  trig¬ 
ger  (TM-30)  units.  The  output  shut-down  signals  were 
also  transformer  isolated. 

Fault  Conditions 

Table  1  lists  the  types  of  faults  that  initiate 
system  shut-down.  Prefires  refer  to  one  or  more 
switches  firing  out  of  sequence  (switch  firing  with¬ 
out  a  trigger  signal).  This  can  result  in  system 
malfunctions  and  thyratron  switch  damage  caused  by 
dumping  all  the  pulser  stored  energy  through  one 
switch.  The  fault  logic  is  designed  to  internally 
generate  six  thyratron  trigger  signals  when  a  prefire 
is  detected  to  insure  that  any  switch  does  not  pass 
more  than  its  share  of  the  total  energy.  The  logic 
also  generates  a  10  volt  (V)  fault  signal  back  to  the 
system  command  console.  This  fault  signal  was  used 
to  trigger  a  crowbar  across  the  load  and  to  shut  down 
the  power  supply. 

Misfire  refers  to  the  failure  of  one  or  more  thy¬ 
ratron  switches  to  fire  when  triggered.  This  will 
result  in  increased  dissipation  in  the  thyratrons 
that  fire,  however,  this  is  not  considered  to  be  as 
serious  a  fault  as  prefire.  The  logic  has  a  provi¬ 
sion  which  allows  the  operator  to  choose  whether  shut¬ 
down  should  be  initiated  by  one  misfire  or  by  two 
consecutive  misfires  of  the  same  switch,  or  by  two 
other  switches.  Misfiring  of  a  thyratron  is  usually 
symptomatic  of  a  need  for  hydrogen  reservoir  adjust¬ 
ment,  or  switch  replacement. 

Continuous  conduction  refers  to  the  inability  of 
any  switch  to  recover  its  voltage  hold-off  capability. 
The  logic  senses  continuous  conduction  by  looking  at 
the  anode  charging  waveform  some  time  after  the 
switches  have  fired.  If  the  signal  from  the  voltage 
divider  senses  an  anode  voltage  below  a  predicted 
minimum,  then  the  logic  will  register  a  continuous 
conduction  fault.  Continuous  conduction  can  also 
result  from  capacitor  failure,  or  a  breakdown  some¬ 
where  in  the  system.  Whenever  continuous  conduction 
occurs,  the  system  must  shut-down. 

Load  fault  is  sensed  as  an  unusually  large  end- 
of-line  clipper  current.  Reference  5.  It  can  result 
from  a  load  arc,  step-up  transformer  breakdown  or  a 
faulty  load  crowbar.  Since  all  networks  are  connected 
in  parallel  when  the  thyratron  switches  are  fired, 
only  one  end-of-line  clipper  current  transformer  out¬ 
put  is  connected  to  the  logic.  Improved  system  relia¬ 
bility  would  he  achieved  if  the  actual  load  current 
were  used  as  the  load  fault  input  signal,  as  it  would 
be  available  regardless  where  the  load  fault  occurred 
in  time  relative  to  the  pulser  firing.  The  logic 
detects  load  fault  as  an  input  signal  exceeding  a 
preset  voltage  threshold. 

Overcurrent  refers  to  excessive  charging  current 
averaged  over  a  period  equal  to  the  inverse  of  the 
repetition  rate.  The  overcurrent  sensor  will  detect 
current  levels  in  excess  of  the  integrated  charging 
current.  This  condition  could  result  from  a  damaged 
charging  choke  or  from  a  leaky  capacitor.  Like  the 
load  fault,  the  overcurrent  condition  is.  sensed  by  an 
input  signal  exceeding  a  preset  voltage  threshold. 


Logic  Operation 

Table  2  lists  the  major  features  of  the  fault 
logic  circuit.  Common  to  all  inputs  in  this  figure 
are  the  isolation  and  shaping  circuits.  The  isolation 
has  been  provided  by  the  current  transformers,  which 
are  electrically  isolated  from  the  pulser  frame.  The 
R.G-58  C/U  coaxial  leads  from  the  current  transformers 
terminate  onto  chassis  BNC  connectors.  The  exception 
is  the  continuous  conduction  sensor  which  is  a  voltage 
divider  and  cannot  be  transformer  isolated.  Until 
recently,  when  optoisolators  were  incorporated  into 
the  input  isolation  stages,  the  voltage  divider  input 
had  not  been  effectively  isolated  from  the  pulser. 
Optoisolators  were  added  to  effectively  limit  damage 
to  the  fault  monitor,  to  a  single  plug-in  component. 
Thus,  extensive  damage  throughout  the  fault  monitor, 
as  a  result  of  extremely  high  signal  input  levels.  Is 
eliminated . 

The  shaping  circuit  is  a  Schmitt  trigger,  which 
embodies  a  15  V  zener  as  an  input  protection  element. 
The  Schmitt  trigger  switches  start  when  the  signal 
level  exceeds  6  V  and  has  a  hysteresis  of  approxi¬ 
mately  IV.  At  full  power,  each  pulsed  MAPS-40  switch 
current  reaches  40,000  amperes  (A).  With  the  thyra¬ 
tron  current  transformer  ratio  of  10,000  A  per  volt, 
the  optoisolator  input  for  each  of  the  thyratron  cur¬ 
rent  signals  will  reach  40  V.  The  optoisolators  have 
approximately  unity  voltage  gain  so  the  fault  monitor 
will  respond  to  thyratron  pulsed  currents  greater  than 
6,000  A.  Lowering  the  Schmitt  trigger  threshold  below 
6  V  to  sense  lower  thyratron  currents  increases  the 
susceptability  of  the  fault  monitor  to  noise  spikes. 

The  selected  threshold  represents  a  good  compromise 
between  range  of  operation  and  noise  immunity. 

Timing  of  the  prefire,  misfire  and  continuous 
conduction  faults  is  shown  in  Figure  2.  The  timing 
zone  diagram  refers  to  the  command  trigger  as  its 
reference  point  in  time.  All  MAPS-40  switches  must 
fire  within  a  5  ys  valid  fire  zone  beginning  at  the 
leading  edge  of  the  command  trigger.  Failure  of  any 
thyratron  switch  to  fire  within  the  valid  fire  zone 
constitutes  a  misfire.  The  5  ys  chosen  includes 
various  triggering  delays  in  the  logic  and  in  the 
pulser,  plus  variation  in  thyratron  switch  firing 
times.  For  the  next  600  ys  when  system  noise  is  the 
greatest  and  input  information  is  of  little  consequence, 
the  logic  is  inhibited  to  prevent  unwanted  noise 
spikes  from  falsely  triggering  the  logic.  The  logic  is 
sensitive  to  prefires  at  any  time  other  than  the  valid 
fire  zone  and  logic  inhibit  zone.  The  continuous 
conduction  signal  is  proportional  to  the  anode  charg¬ 
ing  voltage,  and  is  sampled  8  milliseconds  into  the 
pulse  for  100  Hertz  operation,  80  percent  of  the  inter¬ 
pulse  period.  Threshold  detection  circuits  use  a 
zener  for  absolute  voltage  reference.  A  pair  of  NPN 
and  PNP  transistors  are  used  in  a  ON-ON/OFF-OFF  con¬ 
figuration  in  the  threshold  circuit  to  conserve 
battery  power.  The  circuit  draws  current  only  when 
the  signal  exceeds  the  threshold  limit.  The  threshold 
setting  for  continuous  conduction  was  chosen  as  25 
percent  of  the  value  expected  at  80  percent  into  the 
interpulse  period. 

The  logic  lock-up  circuit  inhibits  the  logic 
registers  when  a  fault  is  detected.  The  lock-up  cir¬ 
cuit  ensures  capturing  the  first  fault  only  of  a 
fault  sequence.  All  subsequent  fault  data  has  no  real 
value.  For  that  rare  event  when  two  or  more  independ¬ 
ent  simultaneous  faults  occur,  the  logic  will  record 
and  display  all  the  simultaneous  faults. 
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The  simplified  diagram  of  the  fault  monitor 
logic  is  shown  in  Figure  3.  To  understand  the  logic 
operation  requires  tracing  each  of  the  input  signals 
through  the  logic.  Each  thyratron  current  trans¬ 
former  input  passes  through  an  isolation  and  shaping 
circuit  and  enters  a  thyratron  switch  identification 
storage  register.  This  register  stores  the  status 
of  each  of  the  MAPS-40  thyratrons  as  a  function  of 
time.  The  logic  examines  the  register  in  accordance 
with  the  timing  diagram.  Figure  2,  in  order  to  deter¬ 
mine  if  a  fault  condition  has  occurred,  and  the  nature 
of  the  fault.  The  identified  fault  is  stored  in  a 
fault  register. 

The  continuous  conduction  signal  upon  shaping 
enters  the  continuous  conduction  threshold  detector. 
When  the  continuous  conduction  gate  signal  reaches 
the  detector,  the  threshold  circuit  examines  the  in¬ 
put  signal  to  determine  if  the  anode  charging  voltage 
exceeds  the  threshold.  If  it  does  not,  then  a  signal 
is  sent  to  its  fault  storage  register.  The  load 
fault  signal,  once  shaped,  is  examined  by  its  thresh¬ 
old  detector  circuit.  If  the  threshold  is  exceeded, 
a  signal  Is  sent  to  the  appropriate  fault  storage 
register.  The  overcurrent  signal  upon  passing 
through  the  shaping  circuit,  is  integrated  and  then 
compared  to  a  predetermined  threshold.  If  the  thresh¬ 
old  is  exceeded,  a  signal  is  sent  to  the  appropriate 
fault  storage  register. 

Once  a  fault  is  registered,  then  two  actions 
occur  simultaneously.  A  shut-down  signal  is  gener¬ 
ated  and  logic  lock-up  is  initiated.  The  outputs  of 
the  switch  identification  storage  register  for  the 
prefire  and  misfire  conditions  are  sent  to  the  display 
circuit  along  with  the  type  of  fault  from  the  fault 
storage  register.  If  a  prefire  condition  is  recorded, 
then  another  signal  is  sent  to  the  thyratron  trigger 
generator.  This  generator  provides  a  firing  signal 
amplified  by  the  trigger  booster  circuit,  to  fire 
all  switches. 

Not  shown  in  the  logic  flow  diagram  is  the  provi¬ 
sion  for  selecting  whether  one  misfire  or  two  consecu¬ 
tive  misfires  are  required  to  generate  shut-down.  The 
two  consecutive  misfires  could  be  from  the  same  switch, 
or  from  two  different  switches.  The  selection  is 
made  by  setting  a  2-position  toggle  switch  located  on 
one  of  the  logic  boards  located  inside  the  logic  enclo¬ 
sure.  If  two  switches  misfire  simultaneously,  then 
both  switch  positions  will  be  displayed.  If  the  same 
switch  misfires  twice,  then  only  one  position  will  be 
displayed.  A  picture  of  the  logic  display  is  shown 
In  Figure  4,  and  the  complete  fault  monitor  logic 
circuit  is  shown  in  Figure  5 . 

Results 


was  one  serious  logic  failure  when  a  switch  prefired 
at  full  voltage  and  simultaneously  its  end-of-line 
clipper  shorted  to  ground.  The  switch  current  trans¬ 
former  experienced  approximately  ten  times  the  normal 
peak  current.  The  signal  from  the  current  transform¬ 
er  destroyed  the  protective  zener  circuit  and  subse¬ 
quently  damaged  many  of  the  CMOS  Integrated  circuits 
on  the  input  board.  To  avoid  further  incidents  of 
this  type  and  to  improve  input  isolation,  the  logic 
input  signals  have  been  optically  isolated.  If  such 
a  rare  event  occurs  again,  then  damage  will  be  con¬ 
fined  to  the  optoisolator  which  can  easily  be 
replaced . 
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TABLE  1 


FAULTS  REQUIRING  SYSTEM  SHUT-DOWN 


1.  Prefires 

2.  Misfires 

3.  Continuous  Conduction 

4.  Load  Faults 

5.  Over  Current 


The  fault  logic  was  first  tested  with  the  compact 
megawatt  module  pulser  in  a  open-loop  configuration. 

The  logic  was  monitored  as  the  pulser  operated  at  the 
megawatt  average  power  condition  for  runs  of  10  to  21 
seconds  duration  at  repetition  rate  of  100  Hertz. 

Once  the  threshold  detector  levels  were  set,  the  fault 
logic  operated  as  expected.  Simulated  faults  were 
properly  detected.  Later,  the  fault  logic  was  oper¬ 
ated  with  five  of  the  six  modules  of  the  ABEL  brass- 
board  modulator,  again  in  an  open-loop  configuration 
(shut-down  output  signal  is  not  used  to  terminate 
system  operation)  for  evaluation  purposes.  The  fault 
monitor  successfully  demonstrated  the  full  detection 
capability,  which  is  required.  In  fact,  it  proved  to 
be  very  useful  in  the  open-loop  configuration,  as  a 
test  instrument  for  aligning  individual  thyratrons  to 
achieve  coincidence  of  firing  times.  Once  all  switches 
were  aligned,  the  logic  operated  as  designed.  There 


TABLE  2 

MAJOR  FEATURES  OF  FAULT  LOGIC  CIRCUIT 


1,  Isolation/Shaping 

2.  Timing 

3.  Threshold  Detection 

4,  Logic  Lock-Up 
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